Do sites without SSL now need one for PayPal IPN?

Question

PayPal is upgrading their certificate and require that people's certificates are also upgraded. Copying the notice below.

But IPN can currently be used without a certificate. Does anyone know if that will not be allowed in future? Or if the older certificates will not work but non-ssl connections will continue to work?

I know it's advisable to have SSL... But some sites want to avoid having SSL and that's why they use PayPal, to avoid asking for credit card information on their site.

PayPal email:

As we have previously communicated to you, PayPal is upgrading the certificate for www.paypal.com to SHA-256. This endpoint is also used by merchants using the Instant Payment Notification (IPN) product.

This upgrade is scheduled for 9/30/2015; however, we may need to change this date on short notice to you to align to the industry security standard.

You’re receiving this notification because you’ve been identified as a merchant who has used IPN endpoints within the past year. If you have not made the necessary changes, we urge you to do so right away to avoid a disruption of your service!

https://www.paypal-community.com/t5/About-Business/PayPal-Endpoint-certificate-upgrade-SHA-256-encryption/m-p/997455#U997455

Merchants using PayPal Instant Payment Notifications (IPN) may be impacted by the change if their web server is not enabled for SHA-256 compliance. If you are using a 3rd party solution for order management and for integrating PayPal on your website, you may be using IPN. Please check with your shopping cart provider to see if you are affected.

and

If you are a merchant who uses IPN with PayPal, your server will need to be upgraded to support SHA-256. Please contact your web host or the checkout partner providing the integration solution to ensure SHA-256 is enabled for the server.

Answer 1

No, PayPal state that SSL will not required for IPN. I contacted PayPal MTS to confirm and got the responses below:

---

PayPal seem to be saying

• if you have SSL yourself, your certificate and its chain need SHA-256 not SHA-1 both for PayPal and modern browser support,
• when you connect to their server, your webserver must accommodate their SHA-256 certificate. Most hosting environments will be fine, but older envs lacking SHA-256 support in SSL libs won't.

PayPals docs are a bit unclear (hence your question!), but they seem to be stating certificates must be SHA-256 rather than all sites require a certificate. In particular the graphic at top of 2015-2016 SSL Cert Change Microsite) can confuse since it says "must be running a SHA-256 compliant server".

My assessment, based on the following (later confirmed via PayPal MTS), is that non-SSL IPN will still be supported. Rationale:

• Requiring SSL for all sites would be a big business change; it would kill IPN on a lot of small orgs who don't have the $$ for SSL hosting.
• PayPal's IPN simulator does not validate the protocol for SSL. If this was a requirement, they would implement it in their simulator.
• PayPal's IPN simulator works using plain HTTP, fails when using SSL to a SHA-1 cert site, and works when using SSL to a SHA-256 cert site.
• PayPal's docs refer to "SHA-256 compliance" and seem to say "require SHA-256 compliant cert" rather than "require a cert".

I've submitted a support question & asked PayPal on Twitter (1, 2). Will update if we get a canonical YES or NO - we have multiple clients asking the same.

Update: Initial responses (reply from MTS, Twitter) are that HTTP IPN will be a supported use case after SHA256 rollout.

Update 2: PayPal Merchant Technical Services have replied that IPN over plain HTTP can be supported once 2015-2016 SSL migration completes. Answer updated.

Update 3: Adding confirmation from @PayPal_Frank in a paypal-community.com forum question

---

All that said - I recommend that ALL organisations using CiviCRM should SSL their traffic for contact privacy. Read Joe Murray's post on the CiviCRM blog and consider your contact's privacy - SSL is inexpensive and helps build trust; it'll probably pay off for your org.

Answer 2

You probably need to pose this question directly to PayPal. It's really a matter of whether they will require a secure connection going forward. It could be that they will force it.

It also may depend upon your host. One client of mine is hosted on HostGator and they too do not have an SSL cert, however in its absence the HostGator SSL cert takes over (and it has SHA-256 encryption). The best way to check this is to go to your site using HTTPS and see if a cert is presented, and if so, you can see whose cert it is and if it has the proper encryption.

As you said it is advisable to have an SSL, and these days, it really is a no-brainer that you should have one. The price for a basic cert is dirt cheap; I usually can get one for $30/yr. Highly recommended.